bloby-bot 0.63.0 → 0.65.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bloby-bot",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "releaseNotes": [
     "1. Fix: image (and audio) attachments now render in chat again — /api/files is fetched with the auth token instead of a raw <img> src that 401'd after the endpoint hardening",
     "2. Affects chat thumbnails, the image lightbox, voice-note playback, and agent image cards",

package/supervisor/app-ws.js

@@ -32,7 +32,6 @@
   function sendChatSubscribe() {
     if (!ws || ws.readyState !== WebSocket.OPEN) return;
     ws.send(JSON.stringify({ type: 'chat:subscribe', data: { clientId: chatClientId } }));
-    console.log('[app-ws] chat:subscribe sent clientId=' + chatClientId);
   }
 
   function buildWsUrl() {
@@ -59,7 +58,6 @@
     for (var i = 0; i < ids.length; i++) {
       var p = pendingRequests[ids[i]];
       clearTimeout(p.timer);
-      console.log('[app-ws] WS dropped, falling back to fetch: ' + p.method + ' ' + p.path);
       p.resolve(originalFetch(p.input, p.init));
     }
     pendingRequests = {};
@@ -74,7 +72,6 @@
       connected = true;
       reconnectDelay = RECONNECT_BASE;
       startHeartbeat();
-      console.log('[app-ws] Connected to /app/ws');
       if (chatSubscribed) sendChatSubscribe();
     };
 
@@ -94,7 +91,6 @@
       }
 
       if (msg.type === 'chat:subscribed') {
-        console.log('[app-ws] chat:subscribed ack clientId=' + (msg.data && msg.data.clientId));
         return;
       }
 
@@ -104,7 +100,6 @@
           clearTimeout(pending.timer);
           delete pendingRequests[msg.data.id];
 
-          console.log('[app-ws] Response via WS: ' + msg.data.status + ' ' + pending.method + ' ' + pending.path);
 
           var responseBody = msg.data.body;
           if (responseBody === null || responseBody === undefined) responseBody = '';
@@ -125,7 +120,6 @@
       failoverPending();
 
       if (!intentionalClose) {
-        console.log('[app-ws] Disconnected, reconnecting in ' + reconnectDelay + 'ms');
         reconnectTimer = setTimeout(function () {
           reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX);
           connect();
@@ -150,14 +144,12 @@
 
     // Fallback: WS not connected
     if (!connected || !ws || ws.readyState !== WebSocket.OPEN) {
-      console.log('[app-ws] WS not connected, falling back to fetch: ' + method + ' ' + url);
       return originalFetch.apply(this, arguments);
     }
 
     // Fallback: non-serializable body (FormData, Blob, ArrayBuffer)
     var body = init && init.body;
     if (body && (body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer)) {
-      console.log('[app-ws] Non-serializable body, falling back to fetch: ' + method + ' ' + url);
       return originalFetch.apply(this, arguments);
     }
 
@@ -189,7 +181,6 @@
       bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
     }
 
-    console.log('[app-ws] Proxying via WS: ' + method + ' ' + reqPath);
 
     ws.send(
       JSON.stringify({
@@ -204,7 +195,6 @@
     return new Promise(function (resolve, reject) {
       var timer = setTimeout(function () {
         delete pendingRequests[id];
-        console.log('[app-ws] Request timed out, falling back to fetch: ' + method + ' ' + reqPath);
         resolve(originalFetch(savedInput, savedInit));
       }, REQUEST_TIMEOUT);
 

package/supervisor/chat/src/hooks/useBlobyChat.ts

@@ -41,7 +41,6 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
     function handleExtMessage(event: MessageEvent) {
       if (event.data?.type === 'bloby:page-context') {
         extensionPageContext.current = event.data.context;
-        console.log('[blobyChat] Extension page context:', event.data.context?.url);
       }
     }
 
@@ -153,11 +152,9 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
   useEffect(() => {
     if (!ws) return;
 
-    console.log('[blobyChat] ──── WS HANDLERS REGISTERED ────');
 
     const unsubs = [
       ws.on('bot:typing', () => {
-        console.log('[blobyChat] bot:typing → streaming=true');
         setStreaming(true);
         setTools([]);
       }),
@@ -175,7 +172,6 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
         // This creates separate message bubbles and shows dots during work
         const content = streamBufferRef.current;
         if (content) {
-          console.log(`[blobyChat] bot:tool (${data.name}) — committing ${content.length} chars as bubble`);
           committedTextLength.current += content.length;
           setMessages((msgs) => [
             ...msgs,
@@ -205,9 +201,6 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
         if (committedTextLength.current > 0) {
           content = content.slice(committedTextLength.current).replace(/^\n+/, '');
           committedTextLength.current = 0;
-          console.log('[blobyChat] bot:response — stripped partial, remaining:', content.slice(0, 60));
-        } else {
-          console.log('[blobyChat] bot:response — new bubble');
         }
 
         // Only add a bubble if there's new content
@@ -232,7 +225,6 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
       ws.on('bot:task-created', () => {
         const content = streamBufferRef.current;
         if (content) {
-          console.log('[blobyChat] bot:task-created — committing stream, showing dots');
           committedTextLength.current += content.length;
           setMessages((msgs) => [
             ...msgs,
@@ -250,11 +242,9 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
       }),
       ws.on('bot:idle', () => {
         // Server confirmed agent is idle — safe to stop streaming
-        console.log('[blobyChat] bot:idle → streaming=false');
         setStreaming(false);
       }),
       ws.on('bot:error', (data: { error: string }) => {
-        console.log('[blobyChat] bot:error');
         setStreamBuffer('');
         streamBufferRef.current = '';
         setStreaming(false);
@@ -334,7 +324,6 @@ export function useBlobyChat(ws: WsClient | null, triggerReload?: number, enable
       // If bot is streaming, commit partial response first
       const partialContent = streamBufferRef.current;
       if (partialContent) {
-        console.log('[blobyChat] Committing partial —', partialContent.length, 'chars');
         committedTextLength.current += partialContent.length;
         setMessages((msgs) => [
           ...msgs,

package/supervisor/chat/src/hooks/useChat.ts

@@ -128,7 +128,6 @@ export function useChat(ws: WsClient | null) {
 
     const unsubs = [
       ws.on('bot:typing', () => {
-        console.log('[useChat] bot:typing → streaming=true');
         setStreaming(true);
         setTools([]);
       }),
@@ -149,7 +148,6 @@ export function useChat(ws: WsClient | null) {
         });
       }),
       ws.on('bot:response', (data: { conversationId: string; messageId?: string; content: string }) => {
-        console.log('[useChat] bot:response — adding message bubble');
         setConversationId(data.conversationId);
 
         // Always add as a new bubble
@@ -170,11 +168,9 @@ export function useChat(ws: WsClient | null) {
       }),
       ws.on('bot:idle', () => {
         // Server confirmed agent is idle — safe to stop streaming
-        console.log('[useChat] bot:idle → streaming=false');
         setStreaming(false);
       }),
       ws.on('bot:error', (data: { error: string }) => {
-        console.log('[useChat] bot:error');
         setStreamBuffer('');
         streamBufferRef.current = '';
         setStreaming(false);
@@ -218,7 +214,6 @@ export function useChat(ws: WsClient | null) {
       // so the user's new message appears BELOW the bot's in-progress text (chronological order)
       const partialContent = streamBufferRef.current;
       if (partialContent) {
-        console.log('[useChat] Committing partial stream buffer as message before user send');
         setMessages((msgs) => [
           ...msgs,
           {

package/supervisor/index.ts

@@ -27,6 +27,7 @@ import { startScheduler, stopScheduler, readPulseConfig, readCronsConfig, nextRu
 import { execSync, spawn as cpSpawn } from 'child_process';
 import crypto from 'crypto';
 import { ChannelManager } from './channels/manager.js';
+import { SHELL_HTML } from './shell.js';
 
 // Last-resort process-level safety nets. The supervisor is the SINGLE process that keeps
 // chat alive (G1) and heals the backend (G3); a stray throw inside an emitter callback
@@ -120,32 +121,29 @@ const SW_JS = `// Service worker — app-shell caching + push notifications
 // cached shell that masks a broken (or just-fixed) frontend and produces the confusing
 // "normal refresh is broken but hard refresh works" split. Cache is a pure offline fallback.
 
-var CACHE = 'bloby-v23';
+var CACHE = 'bloby-v24';
 var HASHED_RE = new RegExp('/assets/.+-[a-zA-Z0-9]{6,}[.](js|css)$');
 
 // Precache the HTML shell on install so the cache is never empty.
 // Without this, the first navigation isn't intercepted (SW wasn't
 // controlling yet), so refresh would find an empty cache → white screen.
 self.addEventListener('install', function(e) {
-  console.log('[SW] installing, cache:', CACHE);
   e.waitUntil(
     caches.open(CACHE)
       .then(function(c) { return c.add('/'); })
-      .then(function() { console.log('[SW] precached / — calling skipWaiting'); return self.skipWaiting(); })
+      .then(function() { return self.skipWaiting(); })
       .catch(function(err) { console.error('[SW] install failed:', err); throw err; })
   );
 });
 
 self.addEventListener('activate', function(e) {
-  console.log('[SW] activating, cache:', CACHE);
   e.waitUntil(
     caches.keys()
       .then(function(keys) {
         var old = keys.filter(function(k) { return k !== CACHE; });
-        if (old.length) console.log('[SW] deleting old caches:', old);
         return Promise.all(old.map(function(k) { return caches.delete(k); }));
       })
-      .then(function() { console.log('[SW] claiming clients'); return self.clients.claim(); })
+      .then(function() { return self.clients.claim(); })
   );
 });
 
@@ -183,18 +181,20 @@ self.addEventListener('fetch', function(event) {
   // /bloby/* is a separate app — let it go to network to avoid
   // caching the wrong HTML under the / key.
   if (request.mode === 'navigate') {
-    console.log('[SW] navigate →', url.pathname);
+    // Workspace iframe documents (?__bloby_frame=1) share pathname '/' with the shell.
+    // Network-only: never c.put() them (would overwrite the precached shell under the '/'
+    // key) and never fall back to c.match('/') (would serve the shell INTO the iframe).
+    if (url.searchParams.has('__bloby_frame')) return;
     if (url.pathname === '/' || url.pathname === '/index.html') {
       // Network-first: always fetch the live dashboard; only fall back to cache when offline.
       event.respondWith(caches.open(CACHE).then(function(c) {
         return fetch(request)
           .then(function(r) { if (r.ok) c.put('/', r.clone()); return r; })
-          .catch(function(err) { console.warn('[SW] / network failed, using cache:', err.message); return c.match('/'); });
+          .catch(function() { return c.match('/'); });
       }));
       return;
     }
     // Other navigations (/bloby/*, etc.) — network only
-    console.log('[SW] navigate (network-only) →', url.pathname);
     return;
   }
 
@@ -421,7 +421,6 @@ export async function startSupervisor() {
     log.error(`Vite dev server failed to start — dashboard degraded, chat still available: ${err instanceof Error ? err.message : err}`);
     vitePorts = { dashboard: -1 }; // sentinel → dashboard proxy serves RECOVERING_HTML
   }
-  console.log(`[supervisor] Upgrade listeners on server: ${server.listenerCount('upgrade')}`);
 
   // Ensure file storage dirs exist
   ensureFileDirs();
@@ -584,7 +583,6 @@ export async function startSupervisor() {
   server.on('request', async (req, res) => {
     // Bloby widget — served directly (not part of Vite build)
     if (req.url === '/bloby/widget.js') {
-      console.log('[supervisor] Serving /bloby/widget.js directly');
       res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
       res.end(fs.readFileSync(paths.widgetJs));
       return;
@@ -592,7 +590,6 @@ export async function startSupervisor() {
 
     // App WS client — served directly (proxies /app/api calls through WebSocket)
     if (req.url === '/bloby/app-ws.js') {
-      console.log('[supervisor] Serving /bloby/app-ws.js directly');
       res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
       res.end(fs.readFileSync(path.join(PKG_DIR, 'supervisor', 'app-ws.js')));
       return;
@@ -626,9 +623,7 @@ export async function startSupervisor() {
     // App API routes → proxy to user's backend server
     if (req.url?.startsWith('/app/api')) {
       const backendPath = req.url.replace(/^\/app/, '');
-      console.log(`[supervisor] → backend :${backendPort} | ${req.method} ${backendPath}`);
       if (!isBackendAlive()) {
-        console.log('[supervisor] Backend down — returning 503');
         res.writeHead(503, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Backend is starting...' }));
         return;
@@ -639,18 +634,10 @@ export async function startSupervisor() {
         (proxyRes) => {
           const ct = String(proxyRes.headers['content-type'] || '');
           const isSse = ct.includes('text/event-stream');
-          if (isSse) {
-            console.log(`[app-proxy] SSE upstream status=${proxyRes.statusCode} ct="${ct}" url=${backendPath}`);
-          }
           res.writeHead(proxyRes.statusCode!, proxyRes.headers);
+          // SSE needs Nagle off so chat tokens flush immediately instead of in batched frames.
           if (isSse) {
             try { res.socket?.setNoDelay(true); } catch {}
-            proxyRes.on('data', (chunk: Buffer) => {
-              console.log(`[app-proxy] SSE chunk bytes=${chunk.length} preview=${JSON.stringify(chunk.toString('utf-8').slice(0, 80))}`);
-            });
-            proxyRes.on('end', () => console.log(`[app-proxy] SSE upstream END`));
-            proxyRes.on('error', (e: any) => console.log(`[app-proxy] SSE upstream ERROR ${e.message}`));
-            res.on('close', () => console.log(`[app-proxy] SSE res CLOSE`));
           }
           proxyRes.pipe(res);
         },
@@ -2134,7 +2121,6 @@ ${alreadyLinked ? '' : `
       if (req.method === 'GET' && agentPath === '/api/agent/chat/stream') {
         const clientId = urlObj.searchParams.get('clientId') || undefined;
         const subId = crypto.randomBytes(8).toString('hex');
-        console.log(`[sse-handler] OPEN sub=${subId} clientId=${clientId} remote=${req.socket.remoteAddress}`);
 
         res.setHeader('Content-Type', 'text/event-stream');
         res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
@@ -2142,19 +2128,14 @@ ${alreadyLinked ? '' : `
         res.setHeader('X-Accel-Buffering', 'no');
         res.writeHead(200);
         try { res.socket?.setNoDelay(true); } catch {}
-        const wrote = res.write(': connected\n\n');
-        console.log(`[sse-handler] wrote initial comment sub=${subId} writeOk=${wrote}`);
+        res.write(': connected\n\n');
 
         const sub: ChatSubscriber = {
           id: subId,
           clientId,
           send: (type, data) => {
-            if (res.writableEnded) {
-              console.log(`[sse-handler] skip write (ended) sub=${subId} type=${type}`);
-              return;
-            }
-            const ok = res.write(`event: ${type}\ndata: ${JSON.stringify(data)}\n\n`);
-            console.log(`[sse-handler] write sub=${subId} type=${type} ok=${ok} bytes=${(type.length + JSON.stringify(data).length + 10)}`);
+            if (res.writableEnded) return;
+            res.write(`event: ${type}\ndata: ${JSON.stringify(data)}\n\n`);
           },
           close: () => { try { res.end(); } catch {} },
         };
@@ -2171,20 +2152,14 @@ ${alreadyLinked ? '' : `
         const keepAlive = setInterval(() => {
           if (res.writableEnded) return;
           res.write(': ping\n\n');
-          console.log(`[sse-handler] ping sub=${subId}`);
         }, 25_000);
 
         req.on('close', () => {
-          console.log(`[sse-handler] CLOSE sub=${subId} reason=req-close`);
           clearInterval(keepAlive);
           chatSubscribers.delete(sub);
         });
-        res.on('close', () => {
-          console.log(`[sse-handler] CLOSE sub=${subId} reason=res-close`);
-        });
-        res.on('error', (err: any) => {
-          console.log(`[sse-handler] ERROR sub=${subId} ${err?.message}`);
-        });
+        // Keep an error listener so a client reset can't surface as an unhandled 'error'.
+        res.on('error', () => {});
         return;
       }
 
@@ -2560,6 +2535,47 @@ ${alreadyLinked ? '' : `
       } catch { /* fall through to Vite */ }
     }
 
+    // Document-ish request? Used by the backend-down interstitial (NOT the shell branch,
+    // which needs top-level-only gating). sec-fetch-dest 'document' covers top-level
+    // navigations; sec-fetch-mode 'navigate' also matches iframe documents (dest 'iframe',
+    // wanted here — the interstitial must show inside the workspace frame too); the accept
+    // fallback covers old clients that send no sec-fetch headers at all.
+    const wantsHtml = req.method === 'GET' && (
+      req.headers['sec-fetch-dest'] === 'document' ||
+      req.headers['sec-fetch-mode'] === 'navigate' ||
+      (!req.headers['sec-fetch-dest'] && String(req.headers['accept'] || '').includes('text/html'))
+    );
+
+    // SHELL INVERSION: TOP-LEVEL document navigations get the immortal shell (bubble +
+    // chat + a same-origin iframe that hosts the actual workspace app). The iframe
+    // re-requests the same URL with ?__bloby_frame=1, which skips this branch and falls
+    // through to the interstitials / Vite proxy below — so Vite reloads, rebuilds, and
+    // crash pages all happen INSIDE the iframe while the chat chrome survives. (The
+    // Lovable/Bolt pattern.) The __bloby_frame param is lost on real in-frame navigations
+    // (<a href> links, location.href redirects, 302s), so the frame is also excluded by
+    // sec-fetch-dest — those requests carry dest 'iframe' and must fall through to Vite,
+    // never get a nested shell. wantsHtml is intentionally NOT reused here: its
+    // mode === 'navigate' arm matches iframe documents (fine for the interstitial below,
+    // wrong for the shell). pathname === '/' is special-cased because the service worker's
+    // install-time precache fetch of '/' may carry no sec-fetch/accept headers yet must
+    // still cache the shell.
+    // Kill switch: BLOBY_NO_SHELL=1 restores legacy behavior (workspace served top-level;
+    // widget.js injects the bubble into the workspace document as before).
+    const fetchDest = req.headers['sec-fetch-dest'];
+    const isSubframe = fetchDest === 'iframe' || fetchDest === 'frame' || fetchDest === 'embed' || fetchDest === 'object';
+    if (
+      req.method === 'GET' &&
+      process.env.BLOBY_NO_SHELL !== '1' &&
+      !(req.url || '').includes('__bloby_frame=1') &&
+      !isSubframe &&
+      (cleanUrl === '/' || fetchDest === 'document' ||
+        (!fetchDest && String(req.headers['accept'] || '').includes('text/html')))
+    ) {
+      res.writeHead(200, { 'Content-Type': 'text/html', 'Cache-Control': 'no-cache', 'X-Bloby-Origin': 'supervisor' });
+      res.end(SHELL_HTML);
+      return;
+    }
+
     // Workspace backend has crash-looped and given up → serve the "backend down" interstitial
     // for dashboard DOCUMENT navigations, instead of proxying to Vite (which serves the user's
     // SPA that then 503s on every /app/api call and, for the common workspace-lock template,
@@ -2567,11 +2583,6 @@ ${alreadyLinked ? '' : `
     // top-level navigations only (not assets/HMR/XHR) and only when the backend has truly given
     // up — never during a normal 1–2s restart. The chat PWA (/bloby/*) is served earlier and is
     // unaffected.
-    const wantsHtml = req.method === 'GET' && (
-      req.headers['sec-fetch-dest'] === 'document' ||
-      req.headers['sec-fetch-mode'] === 'navigate' ||
-      (!req.headers['sec-fetch-dest'] && String(req.headers['accept'] || '').includes('text/html'))
-    );
     if (wantsHtml && isBackendDead()) {
       // X-Bloby-Origin marks this as the agent's OWN branded page so the relay passes it through
       // (and never mistakes it for a Cloudflare tunnel error to be replaced).
@@ -2589,7 +2600,6 @@ ${alreadyLinked ? '' : `
     }
 
     // Everything else → proxy to dashboard Vite dev server
-    console.log(`[supervisor] → dashboard Vite :${vitePorts.dashboard} | ${req.method} ${(req.url || '').split('?')[0]}`);
     const GUARD_TAG = '<script defer src="/bloby/workspace-guard.js"></script>';
     const proxy = http.request(
       { host: '127.0.0.1', port: vitePorts.dashboard, path: req.url, method: req.method, headers: req.headers },
@@ -2638,10 +2648,9 @@ ${alreadyLinked ? '' : `
   const appWss = new WebSocketServer({ noServer: true });
 
   appWss.on('connection', (ws) => {
-    console.log('[supervisor] App API WS client connected');
     // An 'error' event with no listener is rethrown by Node as an uncaught exception,
     // which would crash the whole supervisor. ws still tears down + fires 'close'.
-    ws.on('error', (err: any) => console.warn(`[app-ws] socket error: ${err?.message || err}`));
+    ws.on('error', () => {});
     // Liveness: a half-open socket (mobile/Wi-Fi drop behind the tunnel) never fires 'close', so
     // its chat subscription + maps would leak and broadcastBloby would keep writing to it. The
     // heartbeat below pings; a peer that misses a pong is terminated (which fires 'close' → cleanup).
@@ -2683,7 +2692,6 @@ ${alreadyLinked ? '' : `
           close: () => {},
         };
         chatSubscribers.add(chatSub);
-        console.log(`[app-ws-chat] subscribe sub=${subId} clientId=${clientId} total=${chatSubscribers.size}`);
 
         if (agentQueryActive && currentStreamConvId) {
           chatSub.send('chat:state', {
@@ -2701,7 +2709,6 @@ ${alreadyLinked ? '' : `
       if (msg.type === 'chat:unsubscribe') {
         if (chatSub) {
           chatSubscribers.delete(chatSub);
-          console.log(`[app-ws-chat] unsubscribe sub=${chatSub.id} total=${chatSubscribers.size}`);
           chatSub = null;
         }
         return;
@@ -2712,10 +2719,8 @@ ${alreadyLinked ? '' : `
       const { id, method, path: reqPath, headers: reqHeaders, body } = msg.data;
       const backendPath = (reqPath || '').replace(/^\/app/, '');
 
-      console.log(`[supervisor] App WS → backend :${backendPort} | ${method} ${backendPath} (${id})`);
 
       if (!isBackendAlive()) {
-        console.log('[supervisor] App WS: Backend down — returning 503');
         if (ws.readyState === WebSocket.OPEN) {
           ws.send(JSON.stringify({
             type: 'app:api:response',
@@ -2743,7 +2748,6 @@ ${alreadyLinked ? '' : `
               else if (Array.isArray(v)) resHeaders[k] = v.join(', ');
             }
 
-            console.log(`[supervisor] App WS ← backend: ${proxyRes.statusCode} (${id})`);
 
             if (ws.readyState === WebSocket.OPEN) {
               ws.send(JSON.stringify({
@@ -2772,10 +2776,8 @@ ${alreadyLinked ? '' : `
     ws.on('close', () => {
       if (chatSub) {
         chatSubscribers.delete(chatSub);
-        console.log(`[app-ws-chat] auto-unsubscribe on close sub=${chatSub.id} total=${chatSubscribers.size}`);
         chatSub = null;
       }
-      console.log('[supervisor] App API WS client disconnected');
     });
   });
 
@@ -2783,18 +2785,11 @@ ${alreadyLinked ? '' : `
    *  subscribers. The workspace mirror sees the exact same event stream the widget does. */
   function broadcastBloby(type: string, data: any = {}) {
     const msg = JSON.stringify({ type, data });
-    let wsCount = 0;
     for (const client of blobyWss.clients) {
-      if (client.readyState === WebSocket.OPEN) { client.send(msg); wsCount++; }
+      if (client.readyState === WebSocket.OPEN) client.send(msg);
     }
-    let sseCount = 0;
     for (const sub of chatSubscribers) {
-      try { sub.send(type, data); sseCount++; } catch (e: any) {
-        console.log(`[sse-broadcast] send failed sub=${sub.id}: ${e.message}`);
-      }
-    }
-    if (type.startsWith('bot:') || type.startsWith('chat:')) {
-      console.log(`[sse-broadcast] type=${type} ws=${wsCount} sse=${sseCount} subs=${chatSubscribers.size}`);
+      try { sub.send(type, data); } catch {}
     }
   }
 
@@ -3365,17 +3360,14 @@ ${alreadyLinked ? '' : `
   // Bloby chat WebSocket — Vite HMR is handled automatically (hmr.server = this server)
   server.on('upgrade', async (req, socket: net.Socket, head) => {
     // Strip the query string: /bloby/ws?token=<7-day session token> must not be logged.
-    console.log(`[supervisor] WebSocket upgrade: ${(req.url || '').split('?')[0]} | protocol=${req.headers['sec-websocket-protocol'] || 'none'}`);
 
     // App API WebSocket — no auth (backend handles its own auth)
     if (req.url?.startsWith('/app/ws')) {
-      console.log('[supervisor] → App API WebSocket');
       appWss.handleUpgrade(req, socket, head, (ws) => appWss.emit('connection', ws, req));
       return;
     }
 
     if (!req.url?.startsWith('/bloby/ws')) {
-      console.log('[supervisor] → Letting Vite handle this upgrade');
       return;
     }
 
@@ -3392,7 +3384,6 @@ ${alreadyLinked ? '' : `
       }
     }
 
-    console.log('[supervisor] → Bloby chat WebSocket');
     blobyWss.handleUpgrade(req, socket, head, (ws) => blobyWss.emit('connection', ws, req));
   });
 
@@ -3818,7 +3809,6 @@ ${alreadyLinked ? '' : `
     closeDb();
     await stopBackend();
     stopTunnel();
-    console.log('[supervisor] Stopping Vite dev servers...');
     await stopViteDevServers();
     server.close();
     process.exit(0);

package/supervisor/shell.ts

@@ -0,0 +1,120 @@
+// The immortal shell — served by the supervisor at top-level '/' (and document navigations).
+// It contains ONLY the bubble + chat chrome (widget.js) and a same-origin iframe hosting the
+// user's workspace app. There is NO Vite client here, NO HMR, no service-worker auto-reload —
+// nothing that can reload this page. All workspace reloads, rebuilds, and interstitials
+// (RECOVERING_HTML / backend-down) happen INSIDE the iframe, so the chat — the user's lifeline
+// to the agent — never dies. The iframe src carries ?__bloby_frame=1 so the supervisor routes
+// it past the shell branch to the real workspace (Vite proxy / interstitials).
+// Kill switch: BLOBY_NO_SHELL=1 makes the supervisor skip this entirely (legacy top-level
+// workspace). Static string by design — no server-side templating.
+
+export const SHELL_HTML = `<!DOCTYPE html>
+<html lang="en" style="background-color:#0A0A0A;margin:0;overflow:hidden">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, interactive-widget=resizes-content" />
+    <meta name="theme-color" content="#212121" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+    <meta name="apple-mobile-web-app-title" content="Bloby" />
+    <link rel="icon" type="image/png" href="/morphy-favicon.png" />
+    <link rel="apple-touch-icon" href="/morphy-icon-192.png" />
+    <link rel="manifest" href="/manifest.json" />
+    <title>Bloby</title>
+  </head>
+  <body style="background-color:#0A0A0A;margin:0;overflow:hidden">
+    <!-- Dark background fallback — visible instantly while widget.js loads.
+         The canvas animation (in widget.js) takes over as the actual splash. -->
+    <div id="splash" style="background:#0A0A0A;position:fixed;inset:0;z-index:9998;transition:opacity .25s ease-out"></div>
+
+    <iframe
+      id="bloby-workspace"
+      style="position:fixed;inset:0;width:100vw;height:100dvh;border:none;background:#0A0A0A"
+      allow="camera; microphone; geolocation; clipboard-read; clipboard-write; fullscreen; autoplay; display-capture"
+    ></iframe>
+
+    <script>
+    (function () {
+      var frame = document.getElementById('bloby-workspace');
+
+      // Preserve deep links: the iframe loads the SAME url the shell was opened with, plus
+      // __bloby_frame=1 so the supervisor serves the workspace instead of the shell again.
+      // Collapse leading slashes first — a pathname like '//evil.com' would otherwise be a
+      // protocol-relative URL and point the iframe off-origin under our trusted domain.
+      var path = location.pathname.replace(/^\\/+/, '/');
+      var target = new URL(path + location.search + location.hash, location.origin);
+      if (target.origin !== location.origin) target = new URL('/', location.origin);
+      target.searchParams.set('__bloby_frame', '1');
+
+      // Framed shell self-check: browsers without Fetch Metadata (older Safari/WebViews) can
+      // get a shell served INTO the workspace iframe when an in-frame navigation loses the
+      // __bloby_frame param (the supervisor's sec-fetch-dest exclusion can't see those).
+      // A nested shell replaces itself with the workspace document it should have been.
+      try {
+        if (window.top !== window) {
+          location.replace(target.pathname + target.search + target.hash);
+          return;
+        }
+      } catch (e) { /* cross-origin top — not our nesting case; carry on */ }
+
+      frame.src = target.pathname + target.search + target.hash;
+
+      // widget.js (loaded below, in THIS document) waits for window.__blobyAppReady / the
+      // 'bloby:app-ready' window event before transitioning splash → bubble. The workspace
+      // posts 'bloby:app-ready' up to us; we re-dispatch it locally. Idempotent.
+      var appReadyFired = false;
+      function fireAppReady() {
+        if (appReadyFired) return;
+        appReadyFired = true;
+        window.__blobyAppReady = true;
+        window.dispatchEvent(new Event('bloby:app-ready'));
+      }
+
+      window.addEventListener('message', function (e) {
+        // Same-origin iframe only — drop anything else (extensions, third-party embeds).
+        if (e.origin !== location.origin) return;
+        var d = e.data;
+        if (!d || typeof d.type !== 'string') return;
+        if (d.type === 'bloby:app-ready') {
+          fireAppReady();
+        } else if (d.type === 'bloby:title') {
+          document.title = String(d.title || '').slice(0, 200) || 'Bloby';
+        }
+      });
+
+      // Interstitials and broken workspaces never post 'bloby:app-ready' — the bubble must
+      // still appear (it IS the recovery path). Fire on iframe load, with a timer backstop
+      // for the case where the iframe never finishes loading at all.
+      frame.addEventListener('load', fireAppReady);
+      setTimeout(fireAppReady, 8000);
+
+      // Last-resort splash backstop: only widget.js ever hides #splash (it does so as soon
+      // as its sprite loads, ~1s). If widget.js fails to load, throws, or its sprite fetch
+      // fails, the shell — the user's lifeline — must not sit as a permanent black screen
+      // over the workspace iframe.
+      setTimeout(function () {
+        var s = document.getElementById('splash');
+        if (s && s.style.display !== 'none') s.style.display = 'none';
+      }, 10000);
+    })();
+    </script>
+
+    <script>
+    // Register the SW but DO NOT auto-reload on controllerchange.
+    // The old pattern (skipWaiting + claim + controllerchange → location.reload)
+    // caused surprise reloads on mobile PWAs: iOS aggressively re-checks sw.js
+    // and any byte-level variation in the response (esp. via Vite dev) trips a
+    // new SW activation → controllerchange → unwanted reload. The new SW
+    // silently takes over for future fetches; the user gets the new build on
+    // their next natural refresh.
+    if ('serviceWorker' in navigator) {
+      navigator.serviceWorker.register('/sw.js').catch(function (err) {
+        console.error('[sw-reg] registration failed:', err);
+      });
+    }
+    </script>
+    <script src="/bloby/widget.js"></script>
+  </body>
+</html>
+`;